Executive brief
SigNoz is an open-source observability platform used to monitor application performance and infrastructure. Authenticated users with Viewer role or higher can inject SQL commands through unescaped telemetry field-key names in the v5 query_range API, allowing them to execute arbitrary queries against the underlying ClickHouse database and steal sensitive data from system tables.
Technical details
This is a SQL injection vulnerability in SigNoz's v5 query_range API endpoint. The vulnerability exists because user-supplied telemetry field-key names are not properly escaped before being embedded into ClickHouse SQL queries. Authenticated attackers with Viewer role or higher can exploit this by injecting backticks and quotes into field name parameters to break out of SQL identifier and string literal contexts, allowing execution of arbitrary ClickHouse SQL. The attack requires prior authentication but no additional user interaction. An attacker can read system tables and exfiltrate telemetry data. The vulnerability is fixed in version 0.142.0 and later.
Affected products
- SigNoz SigNoz 0.87.0 to before 0.142.0
Timeline
- 2026-09-17: disclosed